rsync: updated to 3.4.3
rsync 3.4.3 (20 May 2026)
Changes in this version:
SECURITY FIXES:
Six CVEs are fixed in this release. All six are assigned by
VulnCheck as CNA. Affected versions are 3.4.2 and earlier in every
case. Three of the six (CVE-2026-29518, CVE-2026-43617,
CVE-2026-43619) require non-default daemon configuration to reach:
the first and third need `use chroot = no` for a module, the second
needs `daemon chroot = ...` set in rsyncd.conf. Two (CVE-2026-43618,
CVE-2026-43620) are reachable from a normal pull or a normal
authenticated daemon connection. The sixth (CVE-2026-45232) is
reachable only when `RSYNC_PROXY` is set and the proxy (or a MITM)
returns a pathological response. Many thanks to the external
researchers who reported these issues.
[128 lines not shown]
(devel/R-Rcpp) Updated 1.0.14 to 1.1.1.1.1
(pkgsrc)
- Three patches dropped
- Added patch for src/Makevars (by looking at devel/R-fs)
to take care the issue of not finding the function backtrace_symbol
(Atsushi Toyokura helped me a lot on this modification)
- Tested only on NetBSD (9.4), Linux and SunOS are not tested, sorry
(upstream)
Changes in Rcpp non-release version 1.1.1-1.1 (2026-04-19):
* Please see pr #1466 addressing #1465 for context (plus change
from #1460, and R_getRegisteredNamespace from #1469)
* This is an unplanned, unscheduled and uncalled for
non-release made solely to unplug CRAN from late-breaking
changes in R 4.6.0
[165 lines not shown]
unbound: updated to 1.25.1
1.25.1
Bug Fixes
Fix CVE-2026-33278, Possible remote code execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-42959, Crash during DNSSEC validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-32792, Packet of death with DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report.
Fix CVE-2026-40622, "Ghost domain name" variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-41292, Parsing a long list of incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo Alto Networks, for the report.
Fix CVE-2026-42534, Jostle logic bypass degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-42923, Degradation of service with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-42960, Possible cache poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and JianJun Chen, Tsinghua University, for the report.
Fix CVE-2026-44390, Unbounded name compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
axen(4): brush up
Align .Cd introduced in previous with the others.
Don't abuse -tag for -item. Mark up ifconfig media types.
Drop confusing parens around the sentence that says autoselect is the
default. The next sentence is the logical continuation of that
thought, and yet it was outside the parens, torn away from the
sentence it expands upon.
Avoid most 30-40 character runs of alphabet soup. A slash and an 'A'
is an especially nasty combination. Fortunately, commas are a thing.
Give remaining slashes a bit of kerning.
octeon: Add second errata syncw in membar_release
The second syncw is relevant to CN5xxx/Octeon+ for us (ERLite), we don't
currently support CN3xxx but attempt to clarify the commentary around all
this.
There is a seemingly similar detail on cnMIPS, the SYNC_PLUNGER, which is not
dealt with or changed here. This syncw is specifically to work around two
related errata in CN3xxx and CN5xxx.
The OCTEON2 path is a future breadcrumb, we don't build it yet.
Reviewed by: skrll@
Revert "Changes to be committed:"
This reverts commit 6aacc2c531052437f67f7a2b66aaec73b8728c30.
Horrible error, seems to have replaced wip/webkit-gtk/Makefile with glsmac/Makefile, which was NOT intended at all! Sorry!!
